Every package we've recorded in a supply-chain compromise
3,613 packages and 9,256 package–version pairs across 152 incidents. Every entry traces back to a public advisory cited on the incident page.
- npmnpm
2,969 packages across 107 incidents · scannable via package-lock.json
- PyPIPyPI
374 packages across 35 incidents · scannable via requirements.txt
- NuGetNuGet
180 packages across 3 incidents · reference only
- crates.iocrates.io
24 packages across 5 incidents · reference only
- PackagistPackagist
20 packages across 5 incidents · reference only
- GitHub ActionsGitHub Actions
16 packages across 5 incidents · reference only
- GoGo
12 packages across 3 incidents · reference only
- RubyGemsRubyGems
10 packages across 2 incidents · reference only
- Open VSXOpen VSX
5 packages across 3 incidents · reference only
- DockerDocker
3 packages across 3 incidents · reference only
Rather than browse, just check your lockfile - it matches your whole dependency tree against all of these at once, in your browser.